@xopcai/xopc 0.0.376 → 0.0.378

package/dist/src/agent/agent-manager.js

@@ -6,11 +6,10 @@ import { consumeClarificationApproval, init_clarification_wait_repository } from
 import { getInteractionState } from "../storage/sqlite/interaction-state-repository.js";
 import { getSessionMetadata } from "../storage/sqlite/session-read-repository.js";
 import { init_sqlite } from "../storage/sqlite/index.js";
-import { expandWorkspacePathString, init_workspace_path } from "../config/workspace-path.js";
-import { init_agent_scope, listAgentEntries, resolveAgentProfileDir } from "./agent-scope.js";
-import { extractTextContent } from "./context/workspace.js";
 import { resolveUserContextSessionAccess } from "../user-context/access-policy.js";
 import { enqueueConversationLearning } from "../memory-learning/repository.js";
+import { expandWorkspacePathString, init_workspace_path } from "../config/workspace-path.js";
+import { init_agent_scope, listAgentEntries, resolveAgentProfileDir } from "./agent-scope.js";
 import { resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { init_paths, resolveBundledSkillsDir } from "../config/paths.js";
@@ -21,6 +20,7 @@ import { createExtensionAwareStreamFn } from "../providers/extension-stream-brid
 import { traceTools } from "../observability/runtime.js";
 import { continuesAfterTool, trackAiUsageStream } from "../usage/recorder.js";
 import { MemoryLearningService } from "../memory-learning/service.js";
+import { extractTextContent } from "./context/workspace.js";
 import { runPersistentLearningJob } from "./background-review/run-background-review.js";
 import { applyConfigOverrides } from "../config/runtime-overrides.js";
 import { isPersonalConversation } from "../personal-agent/repository.js";

package/dist/src/agent/background-review/run-background-review.js

@@ -5,7 +5,6 @@ import { finishContextExtractionRun } from "../../storage/sqlite/context-extract
 import { getSessionMetadata } from "../../storage/sqlite/session-read-repository.js";
 import { loadCompactionSourceSnapshot } from "../../storage/sqlite/transcript-repository.js";
 import { init_sqlite } from "../../storage/sqlite/index.js";
-import { extractTextContent } from "../context/workspace.js";
 import { resolveUserContextSessionAccess } from "../../user-context/access-policy.js";
 import { failLearningJob, finishLearningJob, learningPolicyHash } from "../../memory-learning/repository.js";
 import { extractProfileAgentId } from "../../config/agent-profile.js";
@@ -22,6 +21,7 @@ import { getAssertionSlot, listUserAssertions } from "../../user-model/repositor
 import { emptyUserModelCaptureResult, executeUserModelInterpretation } from "../../user-model/capture/executor.js";
 import { parseUserModelInterpretation } from "../../user-model/capture/semantic.js";
 import "../../user-model/capture/index.js";
+import { extractTextContent } from "../context/workspace.js";
 import { readAgentMessageContent } from "../memory/agent-message-access.js";
 import { resolveAgentTurnTimeoutMs, runAgentTurnWithTimeout } from "../orchestration/run-agent-turn-with-timeout.js";
 import { isAssistantTurnAborted, isAssistantTurnFailed } from "../orchestration/llm-turn-retry.js";

package/dist/src/agent/embedded/execution-tool-policy.d.ts

@@ -0,0 +1,14 @@
+import type { AgentTool } from '@earendil-works/pi-agent-core';
+export declare const PERSONAL_REQUEST_TOOL_IDS: readonly ["xopc_tool_search", "xopc_tool_describe", "xopc_tool_execute", "personal_request_result", "personal_request_connection"];
+export type ExecutionToolPolicy = Readonly<{
+    surface: 'agent' | 'personal_main' | 'personal_request_worker';
+    nativeMcp: boolean;
+    externalMaterialization: boolean;
+    discovery: boolean;
+    codemode: boolean;
+    revision: string;
+}>;
+/** Resolve from persisted execution identity, never from tool names or model input. */
+export declare function resolveExecutionToolPolicy(conversationId: string): ExecutionToolPolicy;
+export declare function allowsExecutionTool(policy: ExecutionToolPolicy, name: string): boolean;
+export declare function filterExecutionTools(policy: ExecutionToolPolicy, tools: readonly AgentTool[]): AgentTool[];

package/dist/src/agent/embedded/execution-tool-policy.js

@@ -0,0 +1,41 @@
+import { init_connection, isXopcDatabaseOpen } from "../../storage/sqlite/connection.js";
+import { init_request_repository, personalRequestForExecution } from "../../personal-agent/request-repository.js";
+import { getSessionMetadata } from "../../storage/sqlite/session-read-repository.js";
+import { init_session_repository } from "../../storage/sqlite/session-repository.js";
+import { isPersonalConversation } from "../../personal-agent/repository.js";
+import { PERSONAL_MAIN_TOOL_IDS } from "../../personal-agent/policy.js";
+//#region src/agent/embedded/execution-tool-policy.ts
+init_request_repository();
+init_connection();
+init_session_repository();
+const PERSONAL_REQUEST_TOOL_IDS = [
+	"xopc_tool_search",
+	"xopc_tool_describe",
+	"xopc_tool_execute",
+	"personal_request_result",
+	"personal_request_connection"
+];
+/** Resolve from persisted execution identity, never from tool names or model input. */
+function resolveExecutionToolPolicy(conversationId) {
+	let surface = "agent";
+	if (isPersonalConversation(conversationId)) surface = "personal_main";
+	else if (personalRequestForExecution(conversationId) || isXopcDatabaseOpen() && getSessionMetadata(conversationId)?.customData?.personalReadRequestId) surface = "personal_request_worker";
+	const configured = surface === "agent";
+	return {
+		surface,
+		nativeMcp: configured,
+		externalMaterialization: configured,
+		discovery: configured,
+		codemode: configured,
+		revision: "personal-tool-boundaries-v1"
+	};
+}
+function allowsExecutionTool(policy, name) {
+	if (policy.surface === "agent") return true;
+	return (policy.surface === "personal_main" ? PERSONAL_MAIN_TOOL_IDS : PERSONAL_REQUEST_TOOL_IDS).includes(name);
+}
+function filterExecutionTools(policy, tools) {
+	return tools.filter((tool) => allowsExecutionTool(policy, tool.name));
+}
+//#endregion
+export { PERSONAL_REQUEST_TOOL_IDS, allowsExecutionTool, filterExecutionTools, resolveExecutionToolPolicy };

package/dist/src/agent/embedded/run-for-session.js

@@ -8,6 +8,7 @@ import { appendDynamicPromptSection } from "../prompt/cache-boundary.js";
 import { setTraceIdentity, startObservation, traceOperation, traceRun } from "../../observability/runtime.js";
 import { resolveAgentTurnTimeoutMs } from "../orchestration/run-agent-turn-with-timeout.js";
 import { isPersonalConversation } from "../../personal-agent/repository.js";
+import { filterExecutionTools, resolveExecutionToolPolicy } from "./execution-tool-policy.js";
 import { runWithEmbeddedExecutionSession } from "./execution-context.js";
 import { resolvePromptCachePolicy } from "../../providers/prompt-cache-plan.js";
 import { prepareNativeMcpConfig } from "../mcp/native-mcp.js";
@@ -126,7 +127,8 @@ async function runEmbeddedTurnForSessionInner(params) {
 		if (typeof mm.applyResolvedModel === "function") mm.applyResolvedModel(agent, model, modelRef);
 		else await mm.applyModelForSession(agent, conversationId);
 		agentManager.setModelForSession(conversationId, modelRef);
-		const tools = [...agent.state.tools];
+		const executionToolPolicy = resolveExecutionToolPolicy(conversationId);
+		const tools = filterExecutionTools(executionToolPolicy, agent.state.tools);
 		const turnPolicy = agentManager.createAgentTurnPolicy(conversationId);
 		const systemPrompt = appendDynamicPromptSection([agent.state.systemPrompt ?? "", params.presentation === "voice" ? voicePresentationPrompt : ""].filter(Boolean).join("\n\n"), params.dynamicSystemContext ?? "");
 		const idlePolicy = resolveCompactionPolicy(config);
@@ -166,11 +168,11 @@ async function runEmbeddedTurnForSessionInner(params) {
 		};
 		const thinkingLevel = params.thinkingOverride ?? agent.state.thinkingLevel;
 		const workspaceDir = agentManager.getResolvedWorkspaceForSession(conversationId);
-		tools.push(...await materializeNativeExternalTools({
+		if (executionToolPolicy.externalMaterialization) tools.push(...await materializeNativeExternalTools({
 			conversationId,
 			tools
 		}));
-		const mcp = config ? await prepareNativeMcpConfig(config, workspaceDir) : void 0;
+		const mcp = config && executionToolPolicy.nativeMcp ? await prepareNativeMcpConfig(config, workspaceDir) : void 0;
 		const promptCachePolicy = resolvePromptCachePolicy(config ? resolveEffectiveAgentProfileForSession(conversationId).config.runtime.promptCache : void 0);
 		let userMessageForTurn = userMessage;
 		if (params.applyStartupContext !== false) {
@@ -270,7 +272,7 @@ async function runEmbeddedTurnForSessionInner(params) {
 					tools,
 					systemPrompt,
 					thinkingLevel,
-					codemode: config ? resolveEffectiveAgentProfileForSession(conversationId).config.runtime.codemode : void 0,
+					codemode: config && executionToolPolicy.codemode ? resolveEffectiveAgentProfileForSession(conversationId).config.runtime.codemode : void 0,
 					mcp,
 					promptCachePolicy,
 					compactionPolicy: resolveCompactionPolicy(config),

package/dist/src/agent/embedded/run-turn.js

@@ -13,6 +13,7 @@ import { cloudCreditBudgetStopMessage, isCloudCreditBudgetExhausted, reportCloud
 import { isAgentTurnUnsettledError, resolveAgentTurnTimeoutMs, runAgentTurnWithTimeout } from "../orchestration/run-agent-turn-with-timeout.js";
 import { isContextOverflowError } from "../orchestration/context-overflow.js";
 import { getAssistantTurnErrorMessage, isAssistantTurnAborted, isAssistantTurnFailed, maybeRetryTurnAfterTransientLlmFailure, stripTrailingErrorAssistantMessages } from "../orchestration/llm-turn-retry.js";
+import { allowsExecutionTool, filterExecutionTools, resolveExecutionToolPolicy } from "./execution-tool-policy.js";
 import { runWithEmbeddedExecutionSession } from "./execution-context.js";
 import { externalPolicyContext } from "./tool-metadata.js";
 import { isComputerControlActive, isComputerLeaseTool, stopComputerControl } from "../../computer/control-guard.js";
@@ -285,7 +286,9 @@ async function runXopcEmbeddedTurn(params) {
 }
 async function runXopcEmbeddedTurnInner(params) {
 	const { conversationId, runId, userMessage, model, tools: rawTools, systemPrompt, thinkingLevel, workspaceDir, sessionStore, onEvent } = params;
-	const tools = traceTools(rawTools);
+	const toolPolicyConversationId = params.toolPolicyConversationId ?? conversationId;
+	const executionToolPolicy = resolveExecutionToolPolicy(toolPolicyConversationId);
+	const tools = traceTools(filterExecutionTools(executionToolPolicy, rawTools));
 	const timeoutMs = params.timeoutMs || resolveAgentTurnTimeoutMs();
 	const resolvedModel = requireEmbeddedModel(model, params.modelRef);
 	const configuredThinking = isXopcDatabaseOpen() && getSessionMetadata(conversationId) ? resolveEffectiveAgentConfigForSession(conversationId).config.runtime.thinkingLevel : void 0;
@@ -319,6 +322,7 @@ async function runXopcEmbeddedTurnInner(params) {
 			model: resolvedModel,
 			modelRef: params.modelRef,
 			tools,
+			executionToolPolicy,
 			codemode: params.codemode,
 			mcp: params.mcp,
 			systemPrompt: [systemPrompt, rootInstructions].filter(Boolean).join("\n\n"),
@@ -551,6 +555,19 @@ async function runXopcEmbeddedTurnInner(params) {
 		let sentVisibleMessage = false;
 		params.turnPolicy?.reset();
 		session.agent.beforeToolCall = async (context, signal) => {
+			if (!allowsExecutionTool(executionToolPolicy, context.toolCall.name)) return {
+				block: true,
+				reason: "Tool is outside this execution scope."
+			};
+			if (executionToolPolicy.surface !== "agent" && resolveExecutionToolPolicy(toolPolicyConversationId).surface !== executionToolPolicy.surface) {
+				policyStopped = true;
+				quarantineRunner = true;
+				return {
+					block: true,
+					terminate: true,
+					reason: "Execution identity changed. Start a new turn with the current tool policy."
+				};
+			}
 			const resume = getClarificationResumeInput(conversationId, runId);
 			const wait = resume?.payload?.waitId ? getClarification(resume.payload.waitId) : void 0;
 			if (wait?.approvalKey?.startsWith("computer:") && wait.answer !== "已在桌面端处理，继续") await stopComputerControl(conversationId);

package/dist/src/agent/embedded/session-runner.d.ts

@@ -5,6 +5,7 @@ import type { Model, Api } from '@earendil-works/pi-ai';
 import { type GuardedPiTranscriptManager } from './session-tool-result-guard.js';
 import type { EmbeddedTranscriptRuntime } from './transcript-runtime.js';
 import { type CodemodePolicy } from './codemode-extension.js';
+import { type ExecutionToolPolicy } from './execution-tool-policy.js';
 export type EmbeddedRunnerFingerprintInput = {
     transcriptId: string;
     workspaceDir: string;
@@ -16,6 +17,7 @@ export type EmbeddedRunnerFingerprintInput = {
     credentialRevision: string;
     codemode?: CodemodePolicy;
     mcp?: LoadedMcpConfig;
+    executionToolPolicy?: ExecutionToolPolicy;
 };
 export declare function buildEmbeddedRunnerFingerprint(input: EmbeddedRunnerFingerprintInput): string;
 export type AcquireEmbeddedSessionRunnerParams = {
@@ -30,6 +32,7 @@ export type AcquireEmbeddedSessionRunnerParams = {
     transcriptRuntime: EmbeddedTranscriptRuntime;
     codemode?: CodemodePolicy;
     mcp?: LoadedMcpConfig;
+    executionToolPolicy?: ExecutionToolPolicy;
 };
 export type AcquiredEmbeddedSessionRunner = {
     session: AgentSession;

package/dist/src/agent/embedded/session-runner.js

@@ -1,6 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { isCodemodeCoreRead } from "../tools/codemode-permissions.js";
+import { filterExecutionTools, resolveExecutionToolPolicy } from "./execution-tool-policy.js";
 import { deferredToolContract, getXopcToolMetadata } from "./tool-metadata.js";
 import { abortEmbeddedRun } from "./runs.js";
 import { guardSessionManager } from "./session-tool-result-guard.js";
@@ -41,7 +42,8 @@ function buildEmbeddedRunnerFingerprint(input) {
 		input.thinkingLevel,
 		input.credentialRevision,
 		JSON.stringify(input.codemode ?? null),
-		JSON.stringify(input.mcp ?? null)
+		JSON.stringify(input.mcp ?? null),
+		JSON.stringify(input.executionToolPolicy ?? null)
 	].join("\0")).digest("base64url");
 }
 function isEmbeddedSessionRunnerEnabled() {
@@ -109,6 +111,14 @@ var EmbeddedSessionRunnerPool = class {
 	}
 	async acquire(params) {
 		this.stats.acquires += 1;
+		const executionToolPolicy = params.executionToolPolicy ?? resolveExecutionToolPolicy(params.runtimeId);
+		params = {
+			...params,
+			executionToolPolicy,
+			tools: filterExecutionTools(executionToolPolicy, params.tools),
+			mcp: executionToolPolicy.nativeMcp ? params.mcp : void 0,
+			codemode: executionToolPolicy.codemode ? params.codemode : void 0
+		};
 		const fingerprint = buildEmbeddedRunnerFingerprint({
 			transcriptId: params.transcriptId,
 			workspaceDir: params.workspaceDir,
@@ -119,7 +129,8 @@ var EmbeddedSessionRunnerPool = class {
 			thinkingLevel: params.thinkingLevel ?? "medium",
 			credentialRevision: providerCredentialRevision(params.model.provider),
 			codemode: params.codemode,
-			mcp: params.mcp
+			mcp: params.mcp,
+			executionToolPolicy
 		});
 		const reuseEnabled = this.isEnabledFn();
 		const existing = this.pool.get(params.runtimeId);
@@ -132,13 +143,21 @@ var EmbeddedSessionRunnerPool = class {
 			reused = true;
 			this.stats.reuses += 1;
 			entry.session.agent.streamFunction = entry.baseStreamFn;
-			log.debug({ runtimeId: params.runtimeId }, "Reusing pooled embedded session runner");
+			log.debug({
+				runtimeId: params.runtimeId,
+				surface: executionToolPolicy.surface,
+				policyRevision: executionToolPolicy.revision
+			}, "Reusing pooled embedded session runner");
 		} else {
 			if (existing) this.disposePooledRunner(params.runtimeId, existing, "fingerprint_mismatch");
 			entry = await this.createPooledRunner(params);
 			this.pool.set(params.runtimeId, entry);
 			this.stats.creates += 1;
-			log.debug({ runtimeId: params.runtimeId }, "Created embedded session runner");
+			log.debug({
+				runtimeId: params.runtimeId,
+				surface: executionToolPolicy.surface,
+				policyRevision: executionToolPolicy.revision
+			}, "Created embedded session runner");
 		}
 		return {
 			session: entry.session,
@@ -216,12 +235,12 @@ var EmbeddedSessionRunnerPool = class {
 		const discoveryState = piSm.getBranch().findLast((entry) => entry.type === "custom" && entry.customType === "xopc-tool-discovery");
 		const saved = discoveryState?.type === "custom" ? discoveryState.data : void 0;
 		const restored = new Map((saved?.loaded ?? []).map((tool) => [tool.name, tool.contract]));
-		toolNames.push(...tools.filter((tool) => getXopcToolMetadata(tool)?.exposure === "deferred" && restored.get(tool.name) === deferredToolContract(tool)).map((tool) => tool.name));
+		toolNames.push(...tools.filter((tool) => params.executionToolPolicy?.discovery !== false && getXopcToolMetadata(tool)?.exposure === "deferred" && restored.get(tool.name) === deferredToolContract(tool)).map((tool) => tool.name));
 		let boundSession;
 		const mcp = params.mcp;
 		const hasMcp = Boolean(mcp?.servers.length);
 		const usesMcpCodemode = mcp?.servers.some((server) => server.config.enabled !== false && [server.config.exposure ?? "codemode", ...Object.values(server.config.toolExposure ?? {})].includes("codemode"));
-		const codemode = params.codemode?.enabled ? params.codemode : usesMcpCodemode ? {
+		const codemode = params.executionToolPolicy?.codemode === false ? void 0 : params.codemode?.enabled ? params.codemode : usesMcpCodemode ? {
 			enabled: true,
 			timeoutMs: 6e4,
 			maxConcurrentCalls: 4,
@@ -229,7 +248,7 @@ var EmbeddedSessionRunnerPool = class {
 			maxOutputTokens: 4e3
 		} : void 0;
 		if (codemode) toolNames.push("codemode");
-		const discovery = hasMcp || tools.some((tool) => getXopcToolMetadata(tool)?.exposure === "deferred");
+		const discovery = params.executionToolPolicy?.discovery !== false && (hasMcp || tools.some((tool) => getXopcToolMetadata(tool)?.exposure === "deferred"));
 		if (discovery) toolNames.push("tool_search");
 		const modelRuntime = await createEmbeddedModelRuntime(model.provider);
 		const resourceLoader = new DefaultResourceLoader({
@@ -258,6 +277,7 @@ var EmbeddedSessionRunnerPool = class {
 			modelRuntime,
 			resourceLoader,
 			noTools: "builtin",
+			...params.executionToolPolicy?.surface !== "agent" ? { tools: toolNames } : {},
 			customTools: toolDefs
 		});
 		boundSession = session;
@@ -277,7 +297,8 @@ var EmbeddedSessionRunnerPool = class {
 				thinkingLevel: thinkingLevel ?? "medium",
 				credentialRevision: providerCredentialRevision(model.provider),
 				codemode: params.codemode,
-				mcp: params.mcp
+				mcp: params.mcp,
+				executionToolPolicy: params.executionToolPolicy
 			}),
 			session,
 			piSm,

package/dist/src/agent/embedded/types.d.ts

@@ -71,6 +71,8 @@ export type EmbeddedStreamEvent = {
 };
 export type RunXopcEmbeddedTurnParams = {
     conversationId: string;
+    /** Host-owned parent identity for ephemeral runs that inherit its tools. */
+    toolPolicyConversationId?: string;
     runId: string;
     userMessage: AgentMessage;
     model: Model<Api>;

package/dist/src/agent/external-tools/endpoint-provider.js

@@ -1,7 +1,7 @@
-import { ExternalEffectNotAppliedError, executeExternalOperation } from "../../capabilities/runtime/external-operations.js";
-import { canonicalCapabilityJson } from "../../capabilities/runtime/dispatcher.js";
 import { init_src } from "../../../packages/computer-control-contract/src/index.js";
 import "../../../packages/browser-control-contract/src/index.js";
+import { ExternalEffectNotAppliedError, executeExternalOperation } from "../../capabilities/runtime/external-operations.js";
+import { canonicalCapabilityJson } from "../../capabilities/runtime/dispatcher.js";
 import { externalToolRef, parseExternalToolRef } from "./refs.js";
 import { extractDocumentText } from "../../document-understanding/extract.js";
 import { prepareImageForModel } from "../image/prepare-image-for-model.js";

package/dist/src/agent/service/process-direct-streaming.js

@@ -3,8 +3,8 @@ import { init_src } from "../../../packages/gateway-contract/src/index.js";
 import { init_session_input_repository, listTaskUpdateTriggers } from "../../storage/sqlite/session-input-repository.js";
 import { getClarificationResumeInput, init_clarification_wait_repository } from "../../storage/sqlite/clarification-wait-repository.js";
 import { getConnectionResumeInput, init_connection_wait_repository } from "../../storage/sqlite/connection-wait-repository.js";
-import { init_agent_scope, resolveDefaultAgentId } from "../agent-scope.js";
 import { init_agent_session_key, resolveAgentMainConversationId } from "../../routing/agent-session-key.js";
+import { init_agent_scope, resolveDefaultAgentId } from "../agent-scope.js";
 import { readAgentMessageContent } from "../memory/agent-message-access.js";
 import { abortEmbeddedRun } from "../embedded/runs.js";
 import { clearPendingTranscriptUserMessage, setPendingTranscriptUserMessage } from "../inbound/attachment-pipeline.js";

package/dist/src/agent/service.js

@@ -1,14 +1,14 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_attachment_ref, parseNoteAttachmentTarget } from "../notes/attachment-ref.js";
-import { init_agent_scope, resolveAgentHomeDir, resolveDefaultAgentId } from "./agent-scope.js";
-import { extractTextContent } from "./context/workspace.js";
 import { init_agent_session_key, resolveAgentIdFromConversationId } from "../routing/agent-session-key.js";
+import { init_agent_scope, resolveAgentHomeDir, resolveDefaultAgentId } from "./agent-scope.js";
 import { extractProfileAgentId, resolveEffectiveAgentConfigForSession } from "../config/agent-profile.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { init_providers, resolveModel } from "../providers/index.js";
 import { configureTracing, flushTracing } from "../observability/runtime.js";
 import { getUserTimezone } from "../user-model/repository.js";
+import { extractTextContent } from "./context/workspace.js";
 import { resolveAgentTurnTimeoutMs } from "./orchestration/run-agent-turn-with-timeout.js";
 import { applyConfigOverrides } from "../config/runtime-overrides.js";
 import { effectiveWorkspacePathForSession } from "../session/session-workspace.js";
@@ -614,6 +614,7 @@ var AgentService = class {
 		});
 		return runWithEmbeddedExecutionSession(params.executionConversationId, () => runXopcEmbeddedTurn({
 			conversationId: params.executionConversationId,
+			toolPolicyConversationId: params.parentConversationId,
 			verifyChanges: resolveAgentIdFromConversationId(params.parentConversationId) === "coder",
 			runId: params.runId,
 			userMessage,

package/dist/src/agent/session/session-config-service.js

@@ -8,7 +8,6 @@ import { normalizeWorkingDirectoryInput } from "../../session/session-workspace.
 import { getProjectWorkspacePathForSession } from "../../projects/workspace.js";
 import { isPersonalConversation } from "../../personal-agent/repository.js";
 import { getModelThinking } from "../../providers/model-thinking.js";
-import { savePersonalModelConfig } from "../../personal-agent/model-config.js";
 import { normalizeReasoningLevel, normalizeThinkLevel, normalizeVerboseLevel } from "../transcript/thinking-types.js";
 import "../../session/index.js";
 import { mkdir } from "node:fs/promises";
@@ -28,8 +27,7 @@ var SessionConfigService = class {
 	* invalid field. Model and thinking are validated together and committed in one write.
 	*/
 	async patch(conversationId, partial) {
-		const personal = isPersonalConversation(conversationId);
-		const configuredThinking = personal ? void 0 : resolveEffectiveAgentConfigForSession(conversationId).config.runtime.thinkingLevel;
+		const configuredThinking = isPersonalConversation(conversationId) ? void 0 : resolveEffectiveAgentConfigForSession(conversationId).config.runtime.thinkingLevel;
 		if (configuredThinking && partial.thinkingLevel !== void 0 && partial.thinkingLevel !== configuredThinking) return {
 			ok: false,
 			code: "INVALID_THINKING",
@@ -70,7 +68,7 @@ var SessionConfigService = class {
 				};
 				const thinkingLevel = requested ?? chooseModelThinking(capabilities, existing?.thinkingLevel);
 				const modelRef = `${model.provider}/${model.id}`;
-				const updated = personal ? savePersonalModelConfig(conversationId, modelRef, thinkingLevel) : await this.opts.sessionConfigStore.update(conversationId, {
+				const updated = await this.opts.sessionConfigStore.update(conversationId, {
 					modelOverride: modelRef,
 					thinkingLevel,
 					fixedModel: partial.fixedModel ?? existing?.fixedModel ?? false

package/dist/src/agent/skills/index.js

@@ -1,8 +1,8 @@
 import { resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { init_paths } from "../../config/paths.js";
+import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { findInstallSpec, hasBinary, installSkill } from "./installer.js";
 import { applySkillEnvOverrides, createSkillConfigManager, getSkillEnvironment, isSkillEnabled, resolveSkillConfig, validateSkillConfig } from "./config.js";
 import { parseSkillToolConditions } from "./skill-tool-gating.js";

package/dist/src/agent/skills/managed-store.js

@@ -1,5 +1,5 @@
-import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { init_paths, resolveSkillsDir } from "../../config/paths.js";
+import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { loadSkillsLock } from "./hub-lock.js";
 import { dirname, join, resolve, sep } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";

package/dist/src/agent/skills/skill-manage-ops.js

@@ -1,5 +1,5 @@
-import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { init_paths, resolveSkillsDir } from "../../config/paths.js";
+import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { resolveWorkspaceSkillsDir } from "./workspace-skills-dir.js";
 import { formatScanSummary, scanSkillDirectory } from "./scanner.js";
 import { fuzzyFindText, normalizeForFuzzyMatch, normalizeToLF, restoreLineEndings } from "../tools/edit-diff.js";

package/dist/src/agent/tools/factory.js

@@ -8,13 +8,15 @@ import { getSessionMetadata } from "../../storage/sqlite/session-read-repository
 import { patchSessionMetadata } from "../../storage/sqlite/session-repository.js";
 import { getSessionTaskPlan, setSessionTaskPlan } from "../../storage/sqlite/session-task-plan-repository.js";
 import { init_sqlite } from "../../storage/sqlite/index.js";
-import { init_agent_scope, resolveDefaultAgentId } from "../agent-scope.js";
 import { resolveUserContextSessionAccess } from "../../user-context/access-policy.js";
+import { init_agent_scope, resolveDefaultAgentId } from "../agent-scope.js";
 import { resolveEffectiveAgentConfigForAgent, resolveEffectiveAgentConfigForSession } from "../../config/agent-profile.js";
 import { createPersonalAttentionTool } from "./personal-attention-tool.js";
 import { markCodemodeCoreRead } from "./codemode-permissions.js";
-import "../../../packages/browser-control-contract/src/index.js";
+import { LOCAL_READ_MAX_CHARS } from "./local-read-budget.js";
 import { PERSONAL_TOOL_DESCRIPTIONS } from "../../personal-agent/policy.js";
+import { PERSONAL_REQUEST_TOOL_IDS, filterExecutionTools, resolveExecutionToolPolicy } from "../embedded/execution-tool-policy.js";
+import "../../../packages/browser-control-contract/src/index.js";
 import { getEmbeddedExecutionRunId, getEmbeddedExecutionSession } from "../embedded/execution-context.js";
 import { wrapToolsWithProtection } from "./executor.js";
 import { EXTERNAL_TOOL_NAMES } from "../external-tools/gateway-tools.js";
@@ -221,7 +223,10 @@ var AgentToolsFactory = class AgentToolsFactory {
 		const getSkillMgr = options?.getSkillManager;
 		const disabled = options?.disabledTools;
 		let allowed = options?.toolAllowlist ? new Set(options.toolAllowlist) : void 0;
-		const personalToolsConfigured = Boolean(allowed?.has("personal_task") || allowed?.has("personal_preference"));
+		const currentConversationId = () => options?.conversationId ?? this.deps.getCurrentContext?.()?.conversationId;
+		const executionConversationId = currentConversationId();
+		const executionToolPolicy = executionConversationId ? resolveExecutionToolPolicy(executionConversationId) : void 0;
+		const personalToolsConfigured = executionToolPolicy?.surface === "personal_main" || Boolean(allowed?.has("personal_task") || allowed?.has("personal_preference"));
 		const primary = getPrimary?.();
 		const modelHasVision = primary?.input?.includes("image") ?? false;
 		const cfg = this.deps.getConfig?.();
@@ -239,8 +244,6 @@ var AgentToolsFactory = class AgentToolsFactory {
 		});
 		const agentId = options?.agentId;
 		const resolvedAgentId = agentId ?? (cfg ? resolveDefaultAgentId() : "main");
-		const currentConversationId = () => options?.conversationId ?? this.deps.getCurrentContext?.()?.conversationId;
-		const executionConversationId = currentConversationId();
 		const personalExecution = executionConversationId ? personalRequestForExecution(executionConversationId) : void 0;
 		const personalExecutionMarker = executionConversationId && isXopcDatabaseOpen() ? getSessionMetadata(executionConversationId)?.customData?.personalReadRequestId : void 0;
 		if (personalExecution && executionConversationId && personalExecutionMarker !== personalExecution.requestId) patchSessionMetadata(executionConversationId, { customData: {
@@ -248,11 +251,7 @@ var AgentToolsFactory = class AgentToolsFactory {
 			personalReadRequestId: personalExecution.requestId
 		} });
 		if (personalExecution || personalExecutionMarker) {
-			allowed = new Set([
-				"xopc_tool_search",
-				"xopc_tool_describe",
-				"xopc_tool_execute"
-			].filter((name) => !allowed || allowed.has(name)));
+			allowed = new Set(PERSONAL_REQUEST_TOOL_IDS.slice(0, 3).filter((name) => !allowed || allowed.has(name)));
 			allowed.add("personal_request_result");
 			allowed.add("personal_request_connection");
 		}
@@ -287,7 +286,7 @@ var AgentToolsFactory = class AgentToolsFactory {
 			profileMarkdownRoot: options?.profileMarkdownRoot,
 			...personalToolsConfigured ? {
 				defaultMaxLines: 150,
-				maxOutputBytes: 8e3,
+				maxOutputBytes: LOCAL_READ_MAX_CHARS,
 				maxReadBytes: 12e3
 			} : {}
 		});
@@ -409,7 +408,7 @@ var AgentToolsFactory = class AgentToolsFactory {
 			createPublishArtifactsTool(workspace),
 			createReadMediaTool(personalToolsConfigured ? {
 				textOnly: true,
-				maxChars: 8e3,
+				maxChars: LOCAL_READ_MAX_CHARS,
 				maxReadBytes: 12e3
 			} : void 0),
 			...isShareToolAvailable(cfg) ? [createCreateShareTool({
@@ -491,7 +490,8 @@ var AgentToolsFactory = class AgentToolsFactory {
 			}),
 			...this.deps.getSessionStore ? [createSessionRecallTool({
 				getSessionStore: this.deps.getSessionStore,
-				getCurrentConversationId: () => this.deps.getCurrentContext()?.conversationId
+				getCurrentConversationId: currentConversationId,
+				...personalToolsConfigured ? { maxOutputChars: LOCAL_READ_MAX_CHARS } : {}
 			})] : [],
 			...this.deps.getSessionStore && getPrimary ? [createSessionSearchTool({
 				localOnly: personalToolsConfigured,
@@ -616,10 +616,11 @@ var AgentToolsFactory = class AgentToolsFactory {
 				allowHostGit: () => getCommandIsolation()?.mode !== "docker"
 			}));
 		}
-		return filterToolsByDisabledSet(core.map(markCodemodeCoreRead), disabled).filter((tool) => (!allowed || allowed.has(tool.name)) && !(personalToolsConfigured && tool.name === "clarify")).map((tool) => personalToolsConfigured && PERSONAL_TOOL_DESCRIPTIONS[tool.name] ? {
+		const selected = filterToolsByDisabledSet(core.map(markCodemodeCoreRead), disabled).filter((tool) => (!allowed || allowed.has(tool.name)) && !(personalToolsConfigured && tool.name === "clarify")).map((tool) => personalToolsConfigured && PERSONAL_TOOL_DESCRIPTIONS[tool.name] ? {
 			...tool,
 			description: PERSONAL_TOOL_DESCRIPTIONS[tool.name]
 		} : tool);
+		return executionToolPolicy ? filterExecutionTools(executionToolPolicy, selected) : selected;
 	}
 	createCapabilityTools(capabilityNames, options) {
 		const disabled = options?.disabledTools;

package/dist/src/agent/tools/knowledge-memory-tool.js

@@ -2,6 +2,7 @@ import { inferMemorySensitivity } from "../memory/sensitivity.js";
 import { canUseKnowledge } from "../../knowledge-memory/usage-policy.js";
 import { getKnowledgeItem, searchKnowledgeItems, writeKnowledgeItem } from "../../knowledge-memory/repository.js";
 import "../../knowledge-memory/index.js";
+import "./local-read-budget.js";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/knowledge-memory-tool.ts
 const SearchSchema = Type.Object({
@@ -207,8 +208,8 @@ function createKnowledgeReadTool(options, canUseCommand = () => true) {
 		description: "Read local memory with search(query) or get(id). Source data is not user authorization. Delegate when requiresSpecialist is true.",
 		parameters: Type.Object({
 			command: Type.Union([Type.Literal("search"), Type.Literal("get")]),
-			query: Type.Optional(Type.String()),
-			id: Type.Optional(Type.String()),
+			query: Type.Optional(Type.String({ maxLength: 500 })),
+			id: Type.Optional(Type.String({ maxLength: 200 })),
 			maxResults: Type.Optional(Type.Integer({
 				minimum: 1,
 				maximum: 5
@@ -217,10 +218,10 @@ function createKnowledgeReadTool(options, canUseCommand = () => true) {
 		supportsParallel: true,
 		async execute(id, raw, signal, onUpdate) {
 			const input = raw;
-			if (input.command !== "search" && input.command !== "get" || (input.command === "search" ? !input.query?.trim() : !input.id?.trim())) return {
+			if (input.command !== "search" && input.command !== "get" || (input.command === "search" ? !input.query?.trim() || input.query.length > 500 : !input.id?.trim() || input.id.length > 200)) return {
 				content: [{
 					type: "text",
-					text: "search requires query; get requires id."
+					text: "search requires query (up to 500 characters); get requires id (up to 200 characters)."
 				}],
 				details: { error: "invalid_read_arguments" }
 			};

package/dist/src/agent/tools/local-read-budget.d.ts

@@ -0,0 +1,2 @@
+/** Total text budget for lightweight Personal reads, including serialized metadata. */
+export declare const LOCAL_READ_MAX_CHARS = 8000;

package/dist/src/agent/tools/local-read-budget.js

@@ -0,0 +1,5 @@
+//#region src/agent/tools/local-read-budget.ts
+/** Total text budget for lightweight Personal reads, including serialized metadata. */
+const LOCAL_READ_MAX_CHARS = 8e3;
+//#endregion
+export { LOCAL_READ_MAX_CHARS };

package/dist/src/agent/tools/media-read-tool.js

@@ -49,10 +49,11 @@ function createReadMediaTool(options) {
 					const fullText = buffer.toString("utf8");
 					const maxChars = options?.maxChars ?? fullText.length;
 					const truncated = fullText.length > maxChars;
+					const notice = truncated ? "\n[Attachment truncated; delegate full analysis to a specialist.]" : "";
 					return {
 						content: [{
 							type: "text",
-							text: fullText.slice(0, maxChars) + (truncated ? "\n[Attachment truncated; delegate full analysis to a specialist.]" : "")
+							text: fullText.slice(0, Math.max(0, maxChars - notice.length)) + notice
 						}],
 						details: {
 							...metadata,